Netcore NR268 CVE-2026-108932

Exploitation requires the attacker to inject a malicious value into the DHCP Hostname field handled by filter_hosts_dump.cgi, which in practice means a position on the router's local/broadcast network to issue a DHCP request (DHCP is not routable across the internet). The payload is stored and only triggers when an administrator subsequently views the DHCP host-dump page, so success depends on passive admin user interaction (UI:P) against the Netcore NR268 web management interface. Limiting factors: LAN/adjacent access is needed to plant the hostname, an admin must open the affected CGI page, impact is limited to script execution in the admin's browser (integrity-low, no direct confidentiality or availability loss), and it is specific to NR268 firmware 1.7.121109.

This is a stored cross-site scripting flaw (CWE-79) in the DHCP Hostname Handler (filter_hosts_dump.cgi) of the Netcore NR268 router, firmware 1.7.121109. The signals point to a genuine but modest priority. Publicly available exploit code exists (reported by VulDB, with a write-up on GitHub), but it is NOT listed in CISA KEV, and no EPSS score was provided in the input - so there is no evidence of active or widespread exploitation, only disclosed proof-of-concept. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3 MEDIUM) reflects a low-integrity-only impact requiring passive user interaction (an administrator viewing the host dump page). The key discrepancy to verify: the input vector asserts AV:N, but the injection channel is the DHCP Hostname field, which is a layer-2/broadcast LAN protocol - realistically the attacker must be on the local/adjacent network to register a malicious hostname, which argues for an adjacent (AV:A) vector rather than a true internet-facing one. The vendor did not respond to disclosure, so no official fix is confirmed. Net: a real, confirmed-with-POC stored XSS, but constrained to a niche consumer router, requiring LAN position plus admin interaction, with integrity-only impact - not a widespread or high-urgency issue.

An attacker with access to the router's local network connects a device and requests a DHCP lease using a crafted Hostname containing a JavaScript payload. The malicious hostname is stored and later rendered unsanitized when an administrator opens the DHCP host-dump page (filter_hosts_dump.cgi), executing the attacker's script in the admin's authenticated browser session. Public proof-of-concept exploit code for this chain has been disclosed on GitHub.